Elect one fleet torrent seeder per AWS VPC via IMDS cloud_instance_meta.

Agents read vpc-id from EC2 IMDS on auth; the server scopes subnet_primary_seeder to vpc-id with /24 fallback, exposes VPC seeder badges, and documents cross-VPC gossip via peering/TGW.

agent/deploy/cloud_instance_meta_test.go

@@ -0,0 +1,29 @@
+package deploy
+
+import (
+	"context"
+	"testing"
+)
+
+func TestReadEC2InstanceMetaMockIMDS(t *testing.T) {
+	prev := ec2IMDSReadMeta
+	t.Cleanup(func() { ec2IMDSReadMeta = prev })
+	ec2IMDSReadMeta = func(ctx context.Context) (CloudInstanceMeta, error) {
+		return CloudInstanceMeta{VpcID: "vpc-abc123", SubnetID: "subnet-def456", Region: "us-east-1"}, nil
+	}
+	meta := ReadEC2InstanceMeta()
+	if meta.VpcID != "vpc-abc123" {
+		t.Fatalf("meta=%+v", meta)
+	}
+}
+
+func TestReadEC2InstanceMetaNonAWSFallback(t *testing.T) {
+	prev := ec2IMDSReadMeta
+	t.Cleanup(func() { ec2IMDSReadMeta = prev })
+	ec2IMDSReadMeta = func(ctx context.Context) (CloudInstanceMeta, error) {
+		return CloudInstanceMeta{}, context.DeadlineExceeded
+	}
+	if ReadEC2InstanceMeta().Present() {
+		t.Fatal("expected empty meta on non-AWS fallback")
+	}
+}